Questão de Service Configuration #019e3a4f

Kubernetes uses OpenID Connect (OIDC) as a framework to authenticate users with JSON Web Tokens (JWTs). OIDC is an identity layer built on top of the OAuth 2.0 protocol, allowing clients to verify the identity of users based on authentication performed by an authorization server and obtain basic profile information. In Kubernetes, OIDC is configured via API server flags such as --oidc-issuer-url, --oidc-client-id, and --oidc-username-claim. When a user presents a JWT issued by a trusted OIDC provider (e.g., Google, Dex, Keycloak), the Kubernetes API server validates the token's signature, issuer, and claims to authenticate the user and map them to a Kubernetes user identity.

How it Works:

1. The user authenticates with an OIDC provider and receives an ID token (JWT).
2. The user includes this token in API requests (e.g., via kubectl with --token or in the Authorization header).
3. The Kubernetes API server validates the token using the configured OIDC issuer's public keys.
4. The API server extracts the username from a claim (e.g., sub or email) and optionally maps groups from the groups claim.
5. The authenticated user is then authorized based on RBAC or other authorization modes.

Why the correct value is right:
OpenID Connect is the standard protocol for JWT-based authentication in Kubernetes. It is natively supported by the API server and widely used in production clusters for integrating with external identity providers.

Why the incorrect values are wrong:

• OpenID Container: This is not a real protocol or framework. Kubernetes does not use any "container" variant of OpenID.
• OpenID Cluster: This term does not exist in authentication contexts. Kubernetes clusters use OpenID Connect, not "OpenID Cluster".
• OpenID CNCF: The Cloud Native Computing Foundation (CNCF) hosts Kubernetes but does not define an authentication protocol. "OpenID CNCF" is not a valid framework.